An initial release of pltsec has been made. pltsec is a patch against OpenBSD 3.7-STABLE for i386 that blocks procedure linkage table (PLT) hijacking attempts by detecting malicious writes to the PLT.



The patch can be downloaded here.

The liquidation of 1000 iBooks for $50 apiece resulted in a crowd of thousands circling the event in their cars in Richmond, VA. Predictably, pandemonium ensued as people were trampled, someone tried to drive their way through the crowd, and one woman pissed herself rather than relinquish her place in line. The money quote comes from one Jesse Sandler, though: I don't suppose they'd let him use his iBook behind bars?

After three straight days of attacks, counterattacks, and constant caffeine consumption, Shellphish triumphed among a worthy field of eight teams to take first place at the 2005 DEFCON CTF! Kenshoto, the organizers who were tasked with following the footsteps of the ghettohackers and succeeded beyond all expectations, have posted the final scores on their site. Slashdot has a story on the CTF, along with SecurityFocus (which includes Crispin Cowan's take on the setup), but for the blow-by-blow, read on.



There was much mystery and speculation swirling around the setup of this year's competition, as Kenshoto purposefully held back information on the physical setup of the network, how much access to the machines teams would have, what operating system would need to be defended, etc. When the day came and the setup was revealed, not everyone was happy, as Crispin's comments to SecurityFocus made clear. Incidentally, this makes two years in a row that LSM or SELinux-like systems have been undeployable (last year's team images were Windows-based). In particular, this year was a departure from previous setups as the images to be defended were jails on a single FreeBSD 5.4-RELEASE server hosted by kenshoto. Thus, no physical access, firewalls, kernel modifications, etc. were allowed. Nevertheless, I would have to dispute Crispin's claim that no defensive measures were possible on the part of the competing teams. Most services were easily patchable, a network tap provided by kenshoto allowed teams to sniff traffic to and from their jails, and more advanced defenses like syscall interposition were still possible.



As for the vulnerabilities themselves, these were mainly a smattering of web-based services, python scripts, and C-based network daemons. The web-related services were generally easy to deal with, as they could be instrumented and audited rather easily. The binary-only daemons, on the other hand, presented another problem altogether.

To be continued...